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A robust method of detecting Orion Multi-Purpose Crew Vehicle (MPCV) splashdown is 
necessary to ensure crew and hardware safety during descent and after touchdown. The 
proposed method uses a triple redundant system to inhibit Reaction Control System (RCS) 
thruster firings, detach parachute risers from the vehicle, and transition to the post-landing 
segment of the Flight Software (FSW). An in-depth trade study was completed to determine 
optimal characteristics of the touchdown detection method resulting in an algorithm 
monitoring filtered, lever-arm corrected, 200 Hz Inertial Measurement Unit (IMU) vehicle 
acceleration magnitude data against a tunable threshold using persistence counter logic. 
Following the design of the algorithm, high fidelity environment and vehicle simulations, 
coupled with the actual vehicle FSW, were used to tune the acceleration threshold and 
persistence counter value to result in adequate performance in detecting touchdown and 
sufficient safety margin against early detection while descending under parachutes. An 
analytical approach including Kriging and adaptive sampling allowed for a sufficient 
number of finite element analysis (FEA) impact simulations to be completed using minimal 
computation time. The combination of a persistence counter of 10 and an acceleration 
threshold of approximately 57.3 ft/s 2 resulted in an impact performance factor of safety 
(FOS) of 1.0 and a safety FOS of approximately 2.6 for touchdown declaration. An RCS 
termination acceleration threshold of approximately 53.1 ft/s 2 with a persistence counter of 
10 resulted in an increased impact performance FOS of 1.2 at the expense of a lowered 
under-parachutes safety factor of 2.2. The resulting tuned algorithm was then tested on data 
from eight Capsule Parachute Assembly System (CPAS) flight tests, showing an 
experimental minimum safety FOS of 6.1. The formulated touchdown detection algorithm 
will be flown on the Orion MPCV FSW during the Exploration Flight Test 1 (EFT-1) 
mission in the second half of 2014. 


Nomenclature 

a = Standard deviation from the mean 


I. Introduction 

T HE first test flight of the Orion Multi-Purpose Crew Vehicle (MPCV) is set for September of 2014. This 
mission is titled Exploration Flight Test-1 (EFT-1) to underscore the fact that Orion will be NASA’s primary 
vehicle for Human Exploration of Space. The EFT-1 mission consists of two orbits with the first one circular and 
relatively close to Earth, while the second orbit is highly elliptical and will bring Orion back at speeds high enough 
to nearly simulate lunar return or return from some other exploration destination. Orion entry will be guided to 
desired water landing off the coast of the Baja Peninsula. Two Drogue and three Main parachutes will be used to 
slow the vehicle to a gentle landing in the Pacific Ocean. At this point the vehicle must release the parachutes and 
shut down the Reaction Control System (RCS) jets. The RCS jets will be used until touchdown to properly orient the 
vehicle for impact with the water. The chutes need to be released as soon as possible after impact with the water to 
reduce the risk of the capsule flipping upside-down, while the RCS jets need to be safed to eliminate the possibility 
of firing the jets underwater. There is only limited testing available for firing jets in water, and there is potentially 
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high risk to the vehicle if underwater firing does occur. Thus, the Orion design includes an automated touchdown 
detection system. For crewed missions, this system will assist (i.e. provide touchdown indication) and backup an 
incapacitated crew, although the system is prime for any unmanned missions. 

During the first phase of design of the Orion touchdown detection system many concepts were explored, 
including navigated altitude, altitude rate, acceleration, and even salt-water detection. Methods used on other 
spacecraft and landing systems were also evaluated. In the end, a simple yet robust method was chosen: the 
magnitude of the acceleration output by the Orion Inertial Measurement Unit (OIMU). This method only relies on 
the OIMU hardware, which has dual redundancy for EFT-1 and is planned to have triple redundancy for future 
missions. No other navigated solution (i.e. position, velocity, or attitude) is required, and the logic is relatively 
simple, making the technique highly reliable and robust. All that is needed is to determine the proper thresholds 
(RCS termination and chute release) for touchdown declaration that will provide the desired detection reliability, 
while maintaining sufficient safety margin against any false detections. More details on the design choice and initial 
performance can be found in [1]. This paper will detail the design trade study that lead to the final implementation 
and the analysis conducted to design the thresholds and assess performance and safety margins. 

II. Touchdown Detection Logic Overview 

The crew aboard the MPCV is the prime mechanism for touchdown detection during a crewed mission. In the 
case that the crew is not present or unable to perform touchdown detection duties, an automated system will declare 
touchdown. The automatic system will be activated 60 seconds after the drogue jettison command and below 1500- 
foot altitude. If the altitude data from the Global Positioning System (GPS) and the three barometers is deemed 
faulty, the automatic system will be activated 60 seconds after the drogue jettison command with no restrictions on 
altitude. Crew input to the declaration of touchdown is discussed further in Section VII. Additionally, a backup 
timer will be used if altitude data is deemed healthy. This will serve to declare touchdown in the case that both the 
crew and algorithm fail to detect touchdown. Selection of the backup time length is detailed in Section IV. 

III. Design Trade Study 


A. Background 

The touchdown detection algorithm concept consists of checking vehicle IMU data against a specified 
threshold, with the expectation that impact will generate an identifiable signature in the data. Five design decisions 
were included in a trade study to determine the optimal configuration of the algorithm. They include detection 
method, detection frequency, threshold value, persistence counter, and use of filtering. The variable threshold and 
persistence counter parameters allow for tuning of the algorithm to detect a range of signatures such as terrestrial 
(land) landings or water landings. 

B. Analysis Tools 

The parachute dynamics for the study were generated using up to 1109 Decelerator Systems Simulation (DSS) 
Monte Carlo runs for each of six parachute scenarios, described in Table 1. The impact dynamics were generated by 
1811 LS-DYNA runs using initial conditions bounded by the final conditions from DSS. 

Table 1. Parachute Scenarios Modeled with DSS to 

G enerate Dynamic Data for Safety Analysis 

DSS run descriptions 

Nominal 3-mains 

3 mains with one late chute inflation 
2 mains (one chute failure) with one late chute 

inflation 

2 mains (one chute failure) 

3-mains with at 6 a wind dispersions 
3-mains with at 6a wind dispersion & 
increased vertical winds 


The impact portion of touchdown detection analysis utilized MATLAB scripts, which processed data from the 
LS-DYNA simulation for impact dynamics. LS-DYNA is a finite element analysis simulation that is 
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computationally very expensive and time consuming to run. Therefore, a bounding set of 1811 test cases was 
established. MATLAB scripts, implementing IMU models and the detection algorithm, were then run on the 
resulting impact data with varying parameters for analysis. The results of the detection algorithm were then 
expanded from 1811 cases to approximately 53300 cases with a Kriging surface fit using additional MATLAB 
scripts. The Kriging process is discussed further in Section V. 

The parachute dynamics portion of touchdown detection analysis utilized MATLAB scripts processing data 
generated by the Decelerator Systems Simulation (DSS) for parachute dynamics. DSS is a FORTRAN program 
wrapped in MATLAB that can be run in a Monte Carlo fashion. 1109 runs were made for each of the 6 parachute 
scenarios studied. The same MATLAB scripts implementing the FSW model used for the impact analysis then 
processed the DSS data with varying parameters. The analysis tools used to further refine the persistence counter 
and threshold parameters are discussed in Section IV and Section V. 

C. Detection Frequency 

Although the flight software operates at 40 Hz, data is available for touchdown detection at 200 Hz. The 
detection algorithm was run on sets of LS-DYNA data with varying threshold values. By increasing the threshold, 
the algorithm is pushed to the point at which it begins missing the softer landings, giving a basis for comparison. 
The results are shown in Figure 1. 

It is seen that failed detection cases are present at a lower threshold with 40 Hz data than with 200 Hz data. This 
was true for both the accumulated delta-v and acceleration detection methods. In both methods, the number of failed 
detections is greater using 40 Hz data over 200 Hz data. Therefore, improved detection performance can be achieved 
by using 200 Hz data. 

To continue the trade study, a test threshold must be established for consistency. It was chosen to set a threshold 
such that the no detect FOS equaled 1.0. This would give the greatest early false detect FOS, yet still catch the 
softest impact. The data from Figure 1 indicates that this threshold will be in the range of 20 - 25 ft/s 2 for the 
acceleration method, and a similar analysis shows 8.9 - 14.9 ft/s for accumulated delta-v method. The values chosen 
to proceed with the study were approximately 21.9 ft/s 2 and 11.2 ft/s for the acceleration and accumulated delta-v 
methods, respectively, with the expectation that these values would be refined once the algorithm characteristics 
were finalized. Additionally, the FSW allows for independent thresholds for cutting away the parachutes 
(touchdown detected) and for RCS termination. The purpose of this capability is discussed further in Section V. 
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Figure 1. Failed detections as function of threshold for Algorithm Using 40 Hz and 200 Hz Data 
D. Persistence Counter 

The persistence counter is a concept used to increase safety margin and overall robustness by protecting against 
spurious events. A persistence counter of N requires that N consecutive data points exceed the threshold. By 
definition, earlier analyses done without a persistence counter are equivalent to a persistence counter of 1. This 
concept is visualized in Figure 2, the time history of measurements from a single run. For a detailed discussion of 
the persistence counter and factor of safety definitions, see [2]. 

3 

American Institute of Aeronautics and Astronautics 




Figure 2 shows that as the persistence counter increases, the effective maximum detection measurement 
decreases. This increases the early false detect FOS while decreasing the no detect FOS. Another approach to 
understanding the persistence counter is by realizing that the logic dismisses the (N-l) highest measurements in a 
sliding window N data points wide before triggering (if the Nth highest measurement is above the threshold). 

Figure 3 shows that as persistence counter is increased, the impact FOS decreases using acceleration for 
detection, and the same approach can show that the FOS remains relatively unchanged using the accumulated delta- 
v measurements. Under parachutes, the FOS increases as the counter is increased when using acceleration 
measurements, as seen in the figure, and again remains relatively constant when using accumulated delta-v 
measurements. These results show that an increase in persistence counter will increase under-parachutes FOS at the 
expense of impact FOS. A persistence counter value of five was chosen to continue with the trade study, with the 
intention of refining the value once the algorithm characteristics were finalized. 



E. Detection Method 

Two detection methods were assessed in this trade study. The first method is based on the i 
accelerations as reported by the vehicle IMU. A lever arm correction is applied to the data tc 
values of the center of gravity (CG). This magnitude is then compared against a tuned thresholc 
is tripped, touchdown is declared. The other method is based on accumulated change in velocii 
correction is also utilized in this case to output the velocity of the CG. The magnitude of the chc 
a given window of time is summed and compared against a threshold. If the threshold is tr: 
declared. 

The shared pros of the two detection methods include the reliance solely on IMU data. Up 1 
Orion MPCV provide fault tolerance, are rated to handle impact loads, are protected from s 
pressure vessel, and are the most reliable and fundamental piece of hardware on the vehic 
navigation state of any kind is required to evaluate the IMU data and a simplistic design reduce: 
other hand, a detection method based on IMU data will require properly designed threshc 
signature must be large enough to be distinguishable from 
other nominal and off nominal dynamic events. 
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Table 2 compares the safety FOS of the detection 
methods when the impact performance FOS is driven to 
approximately one. The acceleration method provides for a 
larger safety margin under the parachutes for three of the six 

cases, including the three driving cases of 6a winds, 6a 
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winds and vertical winds, and 2 main parachutes with a late 
inflation. The delta-v method provides for a large safety 
margin for the other three cases. 

Additionally, the acceleration magnitude method utilizes 
simpler logic and previous studies have shown that it 
demonstrated faster detection times. The acceleration 
magnitude method was chosen to continue the trade study. 
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F. Filtering 

The impact of a 2nd order filter with cutoff frequency of 
10 Hz and a damping ratio of 0.707 used on the rates and 
accelerations was studied. In order to perform the lever arm 
correction, the angular acceleration of the IMU is required. 

Since this is not available directly from sensors, it is backed 
out from the body rate data by dividing the difference 
between consecutive body rates by the IMU time step. This 
creates the possibility of artificial angular accelerations 
produced by noise in the body rate data. The analysis showed 
that filtering had little effect on the FOS, while providing 
protection against artificial acceleration spikes, therefore 

filtering is included in the algorithm. A flowchart of the final design of the touchdown detecti 
seen in Figure 4. 
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